The ever-growing threats of cascading failures due to cyber-attacks pose a significant challenge to power grid security. A wrong system state estimate caused by a false data injection attack could lead to a wrong control actions and take the system into a more insecure operating condition. As a consequence, an attack-resilient failure mitigation strategy needs to be developed to correctly determine control actions to prevent the propagation of cascades. In this paper, a recovery-based model predictive control methodology is developed to eliminate power system component violations following coordinated cyber-physical attacks where physical attacks are masked by targeted false data injection attacks. Specifically, to address the problem of wrong system state estimation with compromised data, a developed methodology recovers the incorrect states from historical data rather than utilizing the tampered data, and thus allowing control centers to identify proper control actions. Additionally, instead of using a one-step method to optimize control actions, the recovery-based model predictive control methodology scheme incorporates the effect of controls over a finite time horizon and the attack detection delay to make appropriate control decisions. Case studies, performed on IEEE 30-bus and Illinois 200-bus systems, show that the developed recovery-based model predictive control methodology scheme is robust to coordinated attacks and efficient in mitigating cascades.